System/machines/oracles/configuration.nix

{ config, lib, pkgs, inputs, ... }:

{
  # Sops setup for this machine
  sops.secrets = {
    "borg-ssh-key" = {
      sopsFile = ../../secrets/oracles/borg.yaml;
      format = "yaml";
    };
    "borg-password" = {
      sopsFile = ../../secrets/oracles/borg.yaml;
      format = "yaml";
    };
    "friendpack-backblaze" = {
      format = "yaml";
      sopsFile = ../../secrets/oracles/backblaze.yaml;
      owner = config.users.users.nathan.name;
      group = config.users.users.nathan.group;
    };
    "nix-asuran" = {
      format = "yaml";
      sopsFile = ../../secrets/oracles/gitlab.yaml;
    };
  };
  # Setup system configuration
  nathan = {
    programs = {
      utils = {
        devel = true;
        binfmt = true;
      };
    };
    services = {
      nginx = {
        enable = true;
        acme = true;
      };
      matrix = {
        enable = true;
        baseDomain = "mccarty.io";
      };
      borg = {
        enable = true;
        extraExcludes = [
          "*/.cache"
          "*/.tmp"
          "/home/nathan/minecraft/server/backup"
          "/var/lib/postgresql"
          "/var/lib/redis"
          "/var/lib/docker"
          "/var/log"
          "/var/minecraft"
          "/var/sharedstore"
        ];
        passwordFile = config.sops.secrets."borg-password".path;
        sshKey = config.sops.secrets."borg-ssh-key".path;
      };
    };
    config = {
      setupGrub = false;
      nix = {
        autoUpdate = true;
        autoGC = true;
      };
      harden = false;
      virtualization = { docker = true; };
    };
  };
  # Configure bootloader
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  # Configure networking
  networking = {
    domain = "mccarty.io";
    useDHCP = false;
    interfaces.enp1s0f1.ipv4.addresses = [{
      address = "104.238.220.96";
      prefixLength = 24;
    }];
    defaultGateway = "104.238.220.1";
    nameservers = [ "1.1.1.1" ];
    # Open ports in firewall
    firewall = {
      allowedTCPPorts = [ 25565 ];
      allowedUDPPorts = [ 25565 ];
    };
  };

  # Setup home manager
  home-manager.users.nathan = import ./home.nix;

  # Setup minecraft container
  containers.minecraft = let
    b2AccountID = "00284106ead1ac40000000002";
    b2KeyFile = "${config.sops.secrets."friendpack-backblaze".path}";
    b2Bucket = "ForwardProgressServerBackup";
  in {
    config = { pkgs, lib, ... }@attrs:
      let
        # OpenJDK 17
        javaPackage = pkgs.jdk;
      in {
        imports = [ inputs.quilt-server.nixosModules.default ];
        ###
        ## Container stuff
        ###
        # Let nix know this is a container
        boot.isContainer = true;
        # Set system state version
        system.stateVersion = "22.05";
        # Setup networking
        networking.useDHCP = false;
        # Allow minecraft out
        networking.firewall.allowedTCPPorts = [ 25565 ];

        ###
        ## User
        ###
        users = {
          mutableUsers = false;
          # Enable us to not use a password, this is a container
          allowNoPasswordLogin = true;
        };

        ###
        ## Configure module
        ###
        forward-progress = {
          services = {
            minecraft = {
              enable = true;
              minecraft-version = "1.18.2";
              quilt-version = "0.17.1-beta.6";
              ram = 6144;
              properties = {
                motd = "Nathan's Private Modded Minecraft";
                white-list = true;
                enforce-whitelist = true;
              };
              packwiz-url = "https://pack.forward-progress.net/0.3/pack.toml";
              acceptEula = true;
            };
            backup = {
              enable = true;
              backblaze = {
                enable = true;
                accountId = b2AccountID;
                keyFile = b2KeyFile;
                bucket = b2Bucket;
              };
            };
          };
        };
      };
    autoStart = true;
    bindMounts = {
      "/var/minecraft" = {
        hostPath = "/var/minecraft";
        isReadOnly = false;
      };
      "/run/secrets/friendpack-backblaze" = {
        hostPath = "/run/secrets/friendpack-backblaze";
      };
    };
    forwardPorts = [
      {
        containerPort = 25565;
        hostPort = 25565;
        protocol = "tcp";
      }
      {
        containerPort = 25565;
        hostPort = 25565;
        protocol = "udp";
      }
    ];
  };

  # Setup vhost for pack website
  services.nginx.virtualHosts."pack.forward-progress.net" = {
    enableACME = true;
    forceSSL = true;
    locations."/".root = "/var/www/pack.forward-progress.net";
    root = "/var/www/pack.forward-progress.net";
  };

  # Backup postgres, as used by matrix
  services.postgresqlBackup = {
    enable = true;
    compression = "none";
    backupAll = true;
    startAt = "OnCalendar=00/2:00";
  };

  # Setup the gitlab runners
  services.gitlab-runner = let
    nix-shared = with lib; {
      dockerImage = "nixpkgs/nix-flakes";
      dockerVolumes = [ "/var/sharedstore:/sharedstore" ];
      dockerDisableCache = true;
      dockerPrivileged = true;
    };
  in {
    enable = true;
    concurrent = 4;
    checkInterval = 1;
    services = {
      # default-asuran = {
      #   registrationConfigFile = "/var/lib/secret/gitlab-runner/asuran-default";
      #   dockerImage = "debian:stable";
      #   dockerVolumes = [
      #     "/var/run/docker.sock:/var/run/docker.sock"
      #   ];
      #   dockerPrivileged = true;
      #   tagList = [ "linux-own" ];
      # };

      nix-asuran = nix-shared // {
        registrationConfigFile = config.sops.secrets.nix-asuran.path;
        tagList = [ "nix" ];
        requestConcurrency = 8;
        limit = 4;
        runUntagged = true;
      };
    };
  };

  # Setup searx-ng docker
  virtualisation.oci-containers.containers."searx-ng" = {
    image = "searxng/searxng";
    autoStart = true;
    ports = [ "8091:8080" ];
    volumes = [ "/var/searxng:/etc/searxng" ];
  };
  services.nginx.virtualHosts."searx-ng.mccarty.io" = {
    enableACME = true;
    forceSSL = true;
    locations."/" = { proxyPass = "http://localhost:8091"; };
  };
}